User: sourcecode

Use SOAPAction http header for firewall filtering

On: Web Services - More Secure or Less?

Aside from SSL; there are other ways to ensure that the HTTP request comes from trusted clients.

• Signed SOAP requests by embedding XML digital sigs
• Use SOAPAction header to provide app level filtering

Here's an extract from the SOAP spec on SOAPAction:

The SOAPAction HTTP request header field can be used to indicate the intent of the SOAP HTTP request. The value is a URI identifying the intent. SOAP places no restrictions on the format or specificity of the URI or that it is resolvable. An HTTP client MUST use this header field when issuing a SOAP HTTP Request.

The presence and content of the SOAPAction header field can be used by servers such as firewalls to appropriately filter SOAP request messages in HTTP. The header field value of empty string ("") means that the intent of the SOAP message is provided by the HTTP Request-URI. No value means that there is no indication of the intent of the message